Knowledge base · AI in HR

May we use AI to screen applicants' online profiles or social media?

Only to a limited extent. Public data about an applicant is also personal data. You need a legal basis, usually legitimate interest; you collect no more than the position requires; you leave sensitive data such as religion or political preference out of account; and you tell the applicant which source you use. An AI tool that analyses profiles or assesses candidates is also covered by the high-risk rules from 2 December 2027.

In force now (since 25 May 2018)Trusq editorial · checked against the official textLast verified: 3 October 2026

Next step: Map your AI tool

Legal basis and necessity

Processing is allowed on the ground of legitimate interests, except where the interests or fundamental rights of the data subject override them ^[1]. You collect no more than necessary for the purpose ^[2]. An online profile can be relevant for a position in which that profile plays a role; a general search into private life rarely is.

Sensitive data

As a rule you may not process data revealing, for example, race, political opinions, religious belief or sexual orientation ^[3]. Make sure a tool that picks up such information does not take it into account.

Informing the applicant

If you do not obtain data from the applicant themselves, you state, among other things, the purpose and the categories of data ^[4] and the source the data comes from, even if it is public ^[5]. You do so within a month, and at the latest at the first contact if you use the data to communicate with them ^[6].

From 2027: high-risk

AI for analysing and filtering applications and evaluating candidates is on the high-risk list ^[7], with duties from 2 December 2027 ^[8].

Sources

[1] GDPR Art. 6(1)(f) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Legal basis of legitimate interest, unless the interests of the data subject override.
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data,
Source, retrieved on 3 October 2026.
[2] GDPR Art. 5(1)(c) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Data minimisation.
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
Source, retrieved on 3 October 2026.
[3] GDPR Art. 9(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Processing of special categories of personal data is prohibited in principle.
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
Source, retrieved on 3 October 2026.
[4] GDPR Art. 14(1)(c) and (d) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). For data that does not come from the data subject: information on purposes and categories.
(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) the categories of personal data concerned;
Source, retrieved on 3 October 2026.
[5] GDPR Art. 14(2)(f) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Information on the source, even if it is public.
(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;
Source, retrieved on 3 October 2026.
[6] GDPR Art. 14(3)(a) and (b) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Period: within a month, or at the latest at the first contact.
(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject;
Source, retrieved on 3 October 2026.
[7] AI Act, Annex III, point 4(a) (AI Act, Regulation (EU) 2024/1689). AI for recruitment or selection is listed in Annex III.
AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates;
Source, retrieved on 3 October 2026.
[8] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
Source, retrieved on 3 October 2026.

Next step

Describe one AI tool, for example your recruitment or planning software, in four questions. You see at once which rules may apply, with the source, before you enter any data.

Map your AI tool

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.